Privacy policy
1. Data controller
The data controller is IS Pracownia Projektowo-Usługowa Paweł Lenik, Raciborsko 529, 32-020 Raciborsko, NIP 6792715082. Contact for data matters: kontakt@gatepost.pl.
2. What Gatepost is and whose data it processes
Gatepost is a WordPress plugin connected to a service running on our server. The plugin is installed by the website owner (the "Customer"). We process data of three kinds of subjects:
- the Customer and the people who manage the site on their behalf (e-mail address, site name, the Google account used to connect Search Console);
- the Customer's website: content metadata (titles, URLs, dates, word and link counts, keyphrases stored in the SEO plugin), technical measurements and a log of search-engine crawler visits;
- visitors of gatepost.pl and gatepostwp.com: technical connection data in server logs.
Gatepost does not process data of the Customer's site readers. The crawl log records only requests identified as search-engine bots, after reverse-DNS verification of the IP address, and stays in the Customer's WordPress database; it is not sent to the service.
3. What data, why and for how long
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
| E-mail address, site name and URL, licence key | Customer account, plugin authentication, contact | Contract (Art. 6(1)(b) GDPR) | While the service is used and 12 months after |
| Content inventory: titles, URLs, type and publication status, dates, word and link counts, keyphrases | Site diagnosis, duplicate gate, internal linking, topic proposals | Contract | Until the next scan (overwritten) and until the site is removed from the service |
| Google Search Console data: queries, impressions, clicks, positions, page URLs | Topic proposals, demand confirmation | Contract; access granted by the Customer at Google | Aggregates cached up to 24 hours; topic proposals until the site is removed |
| Google access tokens (OAuth) | Reading Search Console on the Customer's behalf | Contract; consent given on Google's screen | Until the Customer disconnects the account or the site is removed; stored encrypted |
| Topics, generation runs, article drafts and the gates' verdicts | Delivering the service, showing the Customer the reasons for decisions, cost accounting | Contract; legitimate interest (quality and accounting, Art. 6(1)(f)) | Until the site is removed from the service |
| Server logs: IP address, time, requested URL, user agent | Security, troubleshooting | Legitimate interest | Up to 30 days |
| Service owner account (e-mail, hashed password, session) | Access to the administration panel | Legitimate interest | While the service operates |
4. Google Search Console and Google user data
Connecting Google is voluntary and happens on the Customer's side through Google's consent screen. We request only the webmasters.readonly scope (read access to Search Console data) and the account's e-mail address, to show which account is connected. We cannot write anything to Search Console or access other Google services.
Limited Use. Gatepost's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Search Console data is used solely to provide the features visible to the Customer in Gatepost: proposing topics and confirming demand for their site. It is not sold, not used for advertising, not transferred to third parties except as described in section 5, and humans access it only with the Customer's consent, for security purposes or where required by law. This data is not used to train machine-learning models.
The Customer can disconnect the Google account at any time in the plugin's settings (Search Console tab). The token is then revoked at Google and deleted from our database. Access can also be revoked in the Google account settings (myaccount.google.com/connections).
5. Processors
| Party | What it receives | Purpose |
|---|---|---|
| Anthropic, PBC (USA) | Topic, phrases, titles of the site's existing content, site profile (industry, reach, location), the generated article | Site profiling, writing and assessing articles, adjudicating duplicates. Data is passed through the API; under Anthropic's API terms it is not used to train models. |
| DataForSEO (Estonia / USA) | Keyphrases, country and language code | Search volumes. No site URL or personal data is sent. |
| Google LLC (Ireland / USA) | Search Console queries on the Customer's behalf | Retrieving the data described in section 4. |
| cyber_Folks S.A. (Polska) | All service data | Hosting of the server the service runs on. |
Transfers to the USA rely on the European Commission's standard contractual clauses or an adequacy decision (EU-US Data Privacy Framework), depending on the provider.
6. Cookies
gatepost.pl and gatepostwp.com use no cookies and no analytics. The administration panel uses a session cookie required to log in and a cookie remembering the chosen theme (light/dark). The plugin sets no cookies of its own in the Customer's WordPress.
7. Security
Connections are encrypted (TLS). Google tokens and other secrets are stored encrypted, passwords as hashes. Only the people operating the service have server access. Database backups run daily and are kept for 14 days.
8. Your rights
You have the right to access your data, rectify it, erase it, restrict processing, port it, and object to processing based on legitimate interest. Requests: kontakt@gatepost.pl. You may also lodge a complaint with your supervisory authority; in Poland this is the President of the Personal Data Protection Office (UODO).
Removing a site from the service deletes its inventory, topic proposals, runs, service-side drafts and Google tokens. Drafts already saved in the Customer's WordPress remain there. Uninstalling the plugin with "Remove all Gatepost data" checked deletes the crawl log and settings in WordPress.
9. Changes
We will inform Customers by e-mail of material changes to this policy before they take effect. The current version is always available at this address.